Commit 724cc4ae authored by Tong Zhang's avatar Tong Zhang Committed by Zheng Zengkai
Browse files

can: c_can_pci: c_can_pci_remove(): fix use-after-free 

stable inclusion
from stable-5.10.27
commit 524320e8034a9100bea04f311297a395f31bb857
bugzilla: 51493

--------------------------------

[ Upstream commit 0429d6d8 ]

There is a UAF in c_can_pci_remove(). dev is released by
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
To fix this issue, save the mmio address before releasing dev.

Fixes: 5b92da04 ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com


Signed-off-by: default avatarTong Zhang <ztong0001@gmail.com>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatar&nbsp; Weilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 0319426d

drivers/net/can/c_can/c_can_pci.c

+2 −1
Original line number Diff line number Diff line
@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) 
{

	struct net_device *dev = pci_get_drvdata(pdev);

	struct c_can_priv *priv = netdev_priv(dev);

	void __iomem *addr = priv->base;



	unregister_c_can_dev(dev);



	free_c_can_dev(dev);



	pci_iounmap(pdev, priv->base);

	pci_iounmap(pdev, addr);

	pci_disable_msi(pdev);

	pci_clear_master(pdev);

	pci_release_regions(pdev);